Legal
Security
Last updated: 9 October 2026
01Infrastructure
Roastnet runs on enterprise cloud infrastructure in data centres in the United Kingdom, behind load balancers with health-checked, auto-scaling application servers. Deployments are zero-downtime blue/green releases. Static assets are served through a global content delivery network.
02Data isolation
Every customer workspace has its own isolated database. There is no shared business-data store between workspaces, which structurally prevents cross-tenant data access.
03Encryption
All traffic is encrypted in transit with TLS. Data is encrypted at rest on managed storage, and stored credentials and API keys are encrypted at the application layer before they reach the database.
04Payments
Card data never touches Roastnet servers. Payments are processed by a PCI DSS Level 1 payment processing provider; storefront payments settle directly into the roastery's own payment account. Incoming payment webhooks are verified with per-endpoint signing secrets.
05Access control
Workspace access is role-based, with granular permissions enforced server-side on every request, including requests made by AI agents, which run under the invoking user's permissions. Two-factor authentication (TOTP) is available for logins and for step-up approval of sensitive actions. Market API keys are scoped to a single business and can be revoked at any time.
06Backups and continuity
Databases are backed up automatically on a rolling schedule, and infrastructure is defined so that services can be rebuilt from configuration. Immutable, versioned asset storage prevents deployment-time corruption.
07Development practices
Changes ship through code review, automated test suites and staged deployment. Secrets are held in managed secret stores, never in source control, with automated scanning to enforce this.
08Responsible disclosure
If you believe you have found a vulnerability, email [email protected] with details and steps to reproduce. We acknowledge reports promptly, keep you informed while we investigate, and do not pursue good-faith research conducted within the law.
Questions about these documents? Contact the team.